AWS CloudTrail S3 bucket configuration and object restore tampering via management API calls

Flags CloudTrail S3 management API actions that modify bucket protections or move/restore objects.

FreeUnreviewedSigmalowv1

aws-cloudtrail-s3-bucket-configuration-and-object-restore-tampering-via-manageme-78b3756a

title: AWS CloudTrail S3 bucket configuration and object restore tampering via management API calls
id: c8d90b9a-dced-437b-a995-7e77e03abf1a
status: test
description: This rule identifies CloudTrail events where an actor performs S3 data management operations, including changing bucket logging, website settings, encryption configuration, lifecycle and replication configuration, replicating objects, and restoring objects. Such actions can weaken security controls, alter how data is retained or protected, or move data via replication, which attackers may use to enable stealthy exfiltration or disrupt recoverability. It relies on CloudTrail records with eventSource set to s3.amazonaws.com and eventName matching the listed S3 management and restore/replication operations.
references:
  - https://github.com/elastic/detection-rules/pull/1145/files
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html
  - https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_s3_data_management_tampering.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-07-24
modified: 2022-10-09
tags:
  - attack.exfiltration
  - attack.t1537
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: s3.amazonaws.com
    eventName:
      - PutBucketLogging
      - PutBucketWebsite
      - PutEncryptionConfiguration
      - PutLifecycleConfiguration
      - PutReplicationConfiguration
      - ReplicateObject
      - RestoreObject
  condition: selection
falsepositives:
  - A S3 configuration change may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. S3 configuration change from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: 78b3756a-7804-4ef7-8555-7b9024a02e2d
    type: derived

What it detects

This rule identifies CloudTrail events where an actor performs S3 data management operations, including changing bucket logging, website settings, encryption configuration, lifecycle and replication configuration, replicating objects, and restoring objects. Such actions can weaken security controls, alter how data is retained or protected, or move data via replication, which attackers may use to enable stealthy exfiltration or disrupt recoverability. It relies on CloudTrail records with eventSource set to s3.amazonaws.com and eventName matching the listed S3 management and restore/replication operations.

Known false positives

A S3 configuration change may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. S3 configuration change from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.